PaaS services such as Azure Storage and Azure SQL Database get an address reachable from the internet the moment you create them. That is convenient, but many organizations are uneasy knowing that a service holding company data is open only through a public internet address. This is where public endpoints and private endpoints come in, and the official AZ-900 skills outline lists "define public and private endpoints" as a standalone objective.
This post is the networking supplement to our AZ-900 deep-dive series. Learn the fundamentals first, such as virtual networks, VPN Gateway, and ExpressRoute, in Compute and Networking. Here we sort out the difference between the two endpoints, along with service endpoints, which often get mixed into exam questions.
---
What Is an Endpoint?
An endpoint is the entrance to a service, in other words its address. In terms of an office building, a public endpoint is the front door anyone can walk up to, and a private endpoint is a staff-only entrance. Both lead to the same office, but who can use each entrance is different.
Microsoft Learn's definitions are short. Public endpoints have a public IP address and can be accessed from anywhere in the world. Private endpoints exist within a virtual network and have a private IP address from within the address space of that virtual network.
| Category | Public endpoint | Private endpoint | |------|------|------| | Address | A public IP address | A private IP address from your VNet's address space | | Where it can be reached from | Anywhere in the world (can be narrowed with firewall rules) | Inside the VNet and from networks connected to it | | Where it lives | On the service side | Created inside a subnet of your VNet | | Typical example | A storage account's default address (mystorage.blob.core.windows.net) | A network interface with the address 10.0.1.5 inside your VNet |
Exam tip: "Has a public IP address and can be accessed from anywhere" → public endpoint. "A private IP address from the virtual network's address space" → private endpoint. Many questions simply rephrase these definitions, so remember both sentences precisely.
---
Is a Public Endpoint Dangerous?
Having a public endpoint does not mean anyone can read your data. An address being public and access being allowed are two different things. Requests that arrive at the public address still pass through the following safeguards.
Authentication and permissions: most requests must authenticate with credentials such as Microsoft Entra ID or access keys, and permission settings such as RBAC decide what the caller can do Network rules: the service firewall lists the IP ranges or virtual networks to allow and denies the rest Encryption in transit: communication runs over HTTPS (TLS), so no one in the middle can read the contents
Even so, an address exposed to the internet becomes a target for attack attempts, and some organizations are not allowed by regulation to have the path their data travels open to the internet. In those cases you create a private path with a private endpoint and close public access.
Exam tip: An option that says "a public endpoint can be accessed by anyone without authentication" is a wrong statement. What separates public from private is not whether authentication happens, but the address (public IP versus private IP) and the access path.
---
How Does a Private Endpoint Work?
A private endpoint is a network interface (NIC) that uses a private IP address from your VNet. Because that interface connects privately to a service powered by Azure Private Link, the effect is, in Microsoft's own words, "bringing the service into your virtual network." From the VM's point of view, the storage account looks like a server on the same network.
It gets a private IP address from the subnet, and that address does not change for as long as the private endpoint exists It can be reached not only from the same VNet but also from peered VNets and from on-premises networks connected through VPN Gateway or ExpressRoute It connects to one specific resource (for example, a single storage account), not to the whole service DNS must be configured so the same name (FQDN) points to the private IP, usually with a private DNS zone
!How a private endpoint gives a private path to a PaaS service
A Private Endpoint Alone Does Not Block Public Access
This is a common misunderstanding. A private endpoint adds one more entrance with a private address to the service; it does not automatically close the existing front door (the public endpoint). To block internet access as well, you need to turn off public network access on the service or restrict it separately with firewall rules.
Exam tip: If a question says "make the storage account reachable only through a private IP inside the VNet," the answer is a private endpoint. Remember that in practice you also disable public network access alongside it.
---
Don't Confuse It with Service Endpoints
There is also a similarly named feature called a service endpoint. It does not appear directly in the AZ-900 objective wording, but the virtual network unit on Microsoft Learn introduces it as a way for Azure resources to communicate securely, so it can show up as a wrong option.
A service endpoint is something you configure on a subnet. It carries the VNet's identity on traffic leaving that subnet and sends it over the Azure backbone network to the service, so that the service's firewall can have a rule saying "allow only this subnet." The decisive difference from a private endpoint is that the service still uses its public address.
| Category | Service endpoint | Private endpoint | |------|------|------| | The service's address | The service keeps using a public IP address | A private IP address inside your VNet | | How it works | Passes the subnet's identity to the service, and the service firewall allows that subnet | Creates a network interface inside your VNet that is linked to the service resource | | Access from on-premises | Not possible by default | Possible through VPN Gateway or ExpressRoute | | What it connects to | Traffic from the subnet to that service type | One specific resource |
Exam tip: If you see "give the service a private IP address" or "reach it over a private path from on-premises," the answer is a private endpoint. If the question says "the service keeps its public address but only traffic from a specific subnet is allowed," the answer is a service endpoint.
---
How Is This Different from Other Network Connections?
AZ-900's networking objectives include several features that deal with "connecting," so they show up as each other's wrong options. Sorting them by what they connect to what keeps them neatly apart.
| Feature | What it connects | One-line summary | |------|------|------| | VNet peering | VNet ↔ VNet | Connects two virtual networks directly over the Microsoft backbone | | VPN Gateway | An on-premises network or PC ↔ a VNet | An encrypted tunnel over the public internet | | ExpressRoute | An on-premises network ↔ Azure | A dedicated private connection that does not use the internet | | Private endpoint | A VNet ↔ a specific PaaS resource | Gives a PaaS resource a private IP address from the VNet | | Service endpoint | A subnet ↔ a PaaS service type | The service firewall allows traffic coming from that subnet |
Where the first three connect networks to networks, the two endpoints connect a network to PaaS services. That is why they are often used together. A typical setup has an on-premises office connected to a VNet over ExpressRoute, reaching a storage account through a private endpoint in that VNet.
---
Which One Should You Choose?
Here are the three options sorted by situation.
| Situation | Choice | |------|------| | Anyone on the internet must be able to connect, like a public website | Public endpoint | | Keep the public address but allow connections only from the company's IP range | Public endpoint + firewall rules | | A VM must reach a storage account through a private IP without internet exposure | Private endpoint | | An on-premises office must reach Azure SQL Database privately over ExpressRoute | Private endpoint | | Leave the storage account's public address as is, but allow access only from a specific subnet | Service endpoint | | Reduce data exfiltration risk by connecting only to one approved resource | Private endpoint |
The heart of this table is "who comes in, and from where." If outsiders need to come in, use the front door (public); if only the internal network should come in, use the staff entrance (private). Thinking along those lines solves most questions.
---
Exam Quick Reference
The key points to check one last time before you walk into the exam.
| Topic | Key Point | |------|------| | Public endpoint | A public IP address, reachable from anywhere in the world | | Private endpoint | A network interface with a private IP address from the VNet's address space | | Azure Private Link | The technology through which a private endpoint connects privately to a service | | Where it can be reached from | The same VNet, peered VNets, and on-premises networks connected via VPN or ExpressRoute | | DNS | Configure the same name to point to the private IP (private DNS zone) | | Blocking public access | A private endpoint alone does not block it; turn off public network access separately | | Service endpoint | The service keeps its public IP; access is allowed based on the subnet's identity | | Private access from on-premises | Possible with a private endpoint, not possible by default with a service endpoint |
---
Next Steps
Continue with Compute and Networking for the basic structure of VNets, subnets, peering, VPN Gateway, and ExpressRoute, and with Storage Services for the storage accounts you most often connect through private endpoints. If the networking services blur together, the domain 2 tab